PT-2026-35171

A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This impacts an unknown function of the component New RMON History Page. The manipulation of the argument Owner leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

Citrix DaaS - Error: Monitoring page could not be loaded [User authentication Failure]

New custom cloud administrators get the below error when trying to access Monitor console-...

Vitess allows HTML injection in /debug/querylogz & /debug/env

Summary The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. Details These pages are rendered using text/template instead of rendering with a proper HTML...

GHSA-7MWH-Q3XM-QH6P Vitess allows HTML injection in /debug/querylogz & /debug/env

Summary The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. Details These pages are rendered using text/template instead of rendering with a proper HTML...

CVE-2024-53257

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

Improper Authentication

Overview PyNinja is a Lightweight OS-agnostic service monitoring API Affected versions of this package are vulnerable to Improper Authentication due to insufficient authentication for the monitoring page. Remediation Upgrade PyNinja to version 0.0.4 or higher. References - GitHub Commit...

CVE-2018-5757

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...

CVE-2018-5757

AudioCodes 450HD IP Phone devices running firmware 3.0.0.535.106 are affected by CVE-2018-5757. The traceroute and ping functions on the Monitoring page’s web UI pass a user-controllable parameter from a request to command.cgi into an OS command, enabling remote code execution via shell metachara...